Symantec Restricts Crypto Export

PhilK writes "Symantec is now refusing to sell LC5 (the Windows password cracking tool, previously from @stake) to anyone outside of the USA and Canada, claiming new Homeland Security laws. Symantec declined to field questions on the rationale for its policy and whether it applies to other products." From the article: "Symantec's restrictions recall the dark days of the crypto wars when users outside the US were not entitled to buy products featuring strong ciphers. These rules, relaxed by the Clinton administration and following a long running campaign by cryptography experts and net activists, are once again rearing their head. Symantec's response to our reader (below) suggests the policy was imposed on it by the US government."

Comments

ITAR Revisited?

[TripMaster Monkey]

Back in the day, crypto was classified as munitions under ITAR. This restriction was lifted principally because some smart eggs figured out that since the U.S. doesn't have a monopoly on math (no matter how much they might wish that to be the case), foreign countries could develop their own algorithms, so all the U.S was doing was shooting themselves in the foot by restricting what they could do in the international market.

And now, Dubya & Company want to try to restrict crypto once again. I really wish I could say I was surprised, but this is sadly a completely predictable move.

This strategy is doomed to failure, not only because foreign companies are perfectly able to develop their own products, but because these 'restricted' products are easily available on warez servers all over the world. If I want a copy of LC5, I can get one in less than five minutes, entirely free of charge, and I don't need to be in the U.S. to do it.

You might think that D&C would at least try to just keep tabs on international users of LC5 (after all, a wasp in a tent is a lot friendlier when you can see it), but instead, they choose the option to ban export, insuring that truly malicious users will stay well under the radar. Well done, George.

Re:ITAR Revisited?

[dada21]

Last I recall, there are about 201 Democrats (and 1 Socialist?) in Congress. This isn't a republican versus democrat issue, this is an issue used to make both authoritarian parties in Congress more powerful, along with the Executive Branch. It is the Feds versus the States and the Feds versus the People. I wouldn't say Dubya (or Clinton or anyone else) is alone in violating the rights they're precluded from violating.

Re:ITAR Revisited?

[garcia]

And now, Dubya & Company want to try to restrict crypto once again. I really wish I could say I was surprised, but this is sadly a completely predictable move.

Well, obviously because Clinton relaxed those laws the "terrorists" were able to get these products and then use them against the US! What don't you understand?!

This strategy is doomed to failure, not only because foreign companies are perfectly able to develop their own products, but because these 'restricted' products are easily available on warez servers all over the world. If I want a copy of LC5, I can get one in less than five minutes, entirely free of charge, and I don't need to be in the U.S. to do it.

Just like anything that we try to restrict the "terrorists" from getting their hands on. It's a losing battle but one that's not meant to do anything to stop terrorism. It's meant to control the US population.

You might think that D&C would at least try to just keep tabs on international users of LC5 (after all, a wasp in a tent is a lot friendlier when you can see it), but instead, they choose the option to ban export, insuring that truly malicious users will stay well under the radar. Well done, George.

It's just another way to help the trade deficit!

Re:ITAR Revisited?

[hal9000(jr)]

Back in the day, crypto was classified as munitions under ITAR.

Yeah, and it was actually easier to import strong crypto than export it, so alot of companies outside the US became very popular with the security vendors not only for the talentthat exists internationally, but also for the import capabiity.

Re:ITAR Revisited?

[Anonymous Coward]

Well, obviously because Clinton relaxed those laws the "terrorists" were able to get these products and then use them against the US! What don't you understand?!
what the heck are you talking about.... are you blind... deaf or just plainly dumb !!! your goverment is going to boot you and start hurting.... that stupid patriot act is more harmful to americans then anyone else... yes i know you had a terrorist outrage... well shite happens... examine the cause.... tighten the loose ends...

Re:ITAR Revisited?

[Buelldozer]

It's a nice rant, too bad you went off half cocked and one quarter informed. Of course like most Dubya rants it's based on a pile of shit fed to you by the mass media.

Anyway, when your Dubya bashing fervor has cooled enough perhaps you could be bothered to go and actually LOOK at the rules.

Here's a hint, they haven't changed since 1999. The list of countries you can export to hasn't changed either.

The only thing that has changed is that Symantec is now just as ill informed about the law and lazy as you are.

Re:ITAR Revisited?

[garcia]

what the heck are you talking about.... are you blind... deaf or just plainly dumb !!! your goverment is going to boot you and start hurting.... that stupid patriot act is more harmful to americans then anyone else... yes i know you had a terrorist outrage... well shite happens... examine the cause.... tighten the loose ends...

I think you're the one that's confused here. Lighten up. It was all tongue-in-cheek man.

Re:ITAR Revisited?

[Decius6i5]

This isn't news. When encryption software was removed from the ITAR list it was added to the Commerce Control List instead. Encryption export in the US is regulated by BIS "Dubya and Company" didn't do this. This has been the case since the Clinton years. And, no, the government isn't completely confused about the Internet, and they don't think these regulations are useless.

Cryptoanalytic items are more strictly controlled then encryption items because the regs are immature. Few people actually make and export them, and most cryptanalytic stuff is designed for snooping on people and not protecting computer security. The regs are designed with snooping equipment in mind. I don't think Lopht Crack is the droid BIS is looking for, and I figure Symantec could probably get a license to export it if they tried. Furthermore, I figure that if you had an open source cryptanalytic program you could probably distribute it online with the same sort of TSU notification you have to do when you ship open source cryptography software. However, IANAL, so don't take my word for that...

Re:ITAR Revisited?

[schmu_20mol]

who modded this insightful? . . .
I salute to the parent for a real funny comment (albeit apparently a misunderstood one).

Re:ITAR Revisited?

[pete6677]

I really don't understand this line of thinking. If you ask a conservative what they think about banning guns they will tell you that it can't be done because criminals will have guns anyway. Yet in this case, they somehow think the same exact principle doesn't apply. Do they really think international money launderers will no longer be able to get encryption software just because its not legal for export?

Re:ITAR Revisited?

[jcnnghm]

Please explain how a crypto export ban is designed to control the US population.

Re:ITAR Revisited?

[WindBourne]

hummmm. In order to override W, takes what? 2/3 or 3/4 of both houses? At any rates, in the reps, dems represent something like 40%, and in the senate, they are something like 48%. They will have a difficult time outdoing the pres. unless there are republicans who are willing to do the right thing. That will be hard to get. So, at this point, I do not blame the dems for this.

Besides, there are so many other things to nail the dems for. For one, almost all backed W in wanting to invade Iraq, but now call for a pullout before the job is done.

But I also have to agree with you. This is a case of Feds vs. the ppl. We need to start holding congressman accountable for their votes (and sometimes their lack thereof). We do not do this.

Re:ITAR Revisited?

[SpaceLifeForm]

I agree. It was meant to be funny. But obviously, the astromods are out in force. Expect heavy astromoding until Jan 2nd.

Re:ITAR Revisited?

[blincoln]

Please explain how a crypto export ban is designed to control the US population.

Well, literally it restricts what US citizens can do in some way.

More specifically, it means that businesses can't make money selling export-banned products to the rest of the world. I assume it also means that researchers can't collaborate on projects related to banned technology with foreigners.

Re:ITAR Revisited?

[Mr2001]

Last I recall, there are about 201 Democrats (and 1 Socialist?) in Congress. This isn't a republican versus democrat issue

Isn't it? Last I recall, 201 votes is still a minority.

Re:ITAR Revisited?

[Anonymous Coward]

Am I missing something here? Terrorists can get the software anyway. So can foreign governments. Its called software piracy. Someone here buys it and then its in limewire... hello! Bad people still get the software and good people are hosed.

Everyone is a frickin' terrorist now.. i wish this crap would stop. A small group of people took over a plane and murdered a few thousand americans. That was a tragedy. Now our government (US) has taken the rights away from americans (Patriot act, spying on calls, etc) and no one has the balls to call foul. Our government attacked our rights.. not 3000 people.. the entire population of the united states!

Re:ITAR Revisited?

[Penguinshit]

"Ich bin ein Terrorist!"

Violation of my rights

[dada21]

I can't believe that few people see the flagrant violation of the 1st amendment in restricting expression and speech when government prevents code from crossing borders. Even without looking into COnstitutionally protected actions, why do you allow your government to make these victimless-crime laws? You can't stop code from crossing borders (not even in China). If the code does leave this country, it has hurt no one in the process. If some madman uses a Windows password cracking tool to steal a password and hurt someone, it is called trespass and there are already laws governing it.

Anyone still supporting the two big parties in this country is continuing to get what they deserve, I believe. There is no slippery slope of tyranny anymore, they're over the cliff and falling straight down.

Re:Violation of my rights

[Joehonkie]

I'm not in favor of this, but calling it a violation of your right to free speech is totally ridiculous. Free speech clearly means personal expression, not technical data. Or do you somehow believe people be able to send munitions plans to Iran in the name of free speech?

Re:Violation of my rights

[dada21]

Or do you somehow believe people be able to send munitions plans to Iran in the name of free speech?

I do. I should be able to trade with whomever I want to trade, without restrictions by the State. That's what freedom means. If we had open trade and didn't stick our noses in other countries' business, we wouldn't be living under fear of restribution.

Nonetheless, I do believe that the Feds can restrict trade by declaring war. They didn't declare war on Iran, or Iraq or Afghanistan or Bosnia or Vietnam, so trading with those people is fine.

Speech is not just words out of your mouth, speech and expression is everything you do -- how you express yourself. I should be able to express my favorite political candidate in an unlimited way with my words, my voice and my money. I should be able to burn flags, dance, and even wear a dress if I want to. That is what freedom is about.

What does freedom mean to you?

Re:Violation of my rights

[donnyspi]

Your personal freedom stops where your actions begin to infringe on the rights of others. Selling munitions plans to Iran would greatly jeopardize the right to life that Americans enjoy.

Re:Violation of my rights

[dada21]

Your personal freedom stops where your actions begin to infringe on the rights of others. Selling munitions plans to Iran would greatly jeopardize the right to life that Americans enjoy.

Americans have the right to arms. Defend yourself. Form a militia in your town. Learn to love your neighbors, and to be fair to other people. Iran has no power to attack us, and they already have all the munitions plans they need. Iran has the right to self defense just as we do, and I have no problem with every country being equally capable in defending themselves against tyrants. I'm guessing you have a cruel murderer in the family, maybe one stationed in Iraq, eh?

When we declare war against Iran, I'll accept a closing of trade. Then, and only then, will I have a concern about Iran. Until then, I'm happy to let others trade with them, it only makes our country financially stronger and friendlier.

Re:Violation of my rights

[donnyspi]

Iran has no power to attack us...

Remember 9/11, dada? Ordinary people can attack us any day of the week. It doesn't need to be the country of Iran formally declaring war on us.

I'm guessing you have a cruel murderer in the family, maybe one stationed in Iraq, eh? Huuuuh? No.

Re:Violation of my rights

[Pulse_Instance]

What about eating flags?

Freedom, freedom, freedom, oy!
Freedom, freedom, freedom, oy!

Re:Violation of my rights

[dada21]

Remember 9/11, dada? Ordinary people can attack us any day of the week. It doesn't need to be the country of Iran formally declaring war on us.

I do remember 9/11.

Iran did not attack us. Iraq did not attack us. Afghanistan did not attack us. A group of people angry about our murdering 500,000 children in the Middle East attacked us. They died in that attack. We never found their top leaders, even after hundreds of billions of dollars were spent. Game over, move on.

I don't see how one attack killing 3000 people in response to our attacks killing 500,000+ should infringe on my right to trade with whomever I want to and express myself in any way that I want to -- as long as I don't directly hurt someone or their property in the ACT of trading or expressing.

Re:Violation of my rights

[Tim C]

Remember 9/11, dada? Ordinary people can attack us any day of the week.

So what's the point of imposing all these restrictions on foreign countries then? Sounds like it won't actually make you any safer and restricts your business opportunities, not to mention taking time, money and effort to enforce, so why bother?

Re:Violation of my rights

[aaronl]

Here is the problem: restrictions through law only stop those willing to follow the law. Someone that is dedicated to causing harm will not follow the law any further than required to not be detected. It isn't that they are willing to follow the law, they are just willing to stay unnoticed long enough to do what they want, and that happens to look like following law.

Also, as you point out, the country of Iran did not attack the US. Rogue people that may have been citizens of Iran attacked. How do you justify sanctions against the country, when that country did not purpetrate the crime?

Re:Violation of my rights

[ckaminski]

Said attackers needed not crypto, munitions plans, or complex communications gear to pull off said attack. While I can agree with the GP in spirit, in practice I think it's naive to assume plans for missiles and anti-missile tools wouldn't eventually be used against us offensively if they fell into Iranian hands.

But that is why there is an arms race, after all.

Re:Violation of my rights

[Anonymous Coward]

I'm surprised with your oversimplification of the concept of freedom. Saying we can form a militia to protect ourselves is irresponsible. One of the historical reasons for government is to protect its citizens from enemies both forgein and domestic.

I would argue that declaring math of any kind as a munition is silly, but your argument about that government doesn't have an obligation to try to protect us against dangerous information being transferred is equally irrational.

By your standard, it would be okay to give information to a foreign entity that has openly declared hostilities against the United States. I encourage you to continue to fight for freedom, but doing so blindly, without considering the complexities of an international community is damaging to the cause of freedom.

Re:Violation of my rights

[Omnifarious]

And exactly how does restricting munitions exports prevent that sort of attack?

Re:Violation of my rights

[aaronl]

That act of sale does not infringe on the rights of others. A criminal act by the recipient of your goods or services may do so, however. If you were to sell plans for a gun to someone, and then someone used the plans to make a gun, and then committed a crime using it, who is at fault? The modern approach is to blame both. The problem is that only the last person in that chain actually *caused* harm.

Laws and procedures, such as this, restrict the freedoms of everyone, for the supposed reason of stopping a person from committing a crime. The issue is that the person committing the crime will ignore your law, so the law has failed. The result is simply that you have removed a freedom from everyone that would not have been a criminal anyway.

Re:Violation of my rights

[LexNaturalis]

Your definition of speech is somewhat all-encompassing. If I were to want to "express" myself by taking pictures of naked children (without their knowledge, perhaps) and display them on billboards throughout the country your argument would permit that. You base your argument on some sort of arbitrary freedom that you think you have as a member of this country. Nowhere in the Constitution are you granted that freedom.

In fact, the Commerce clause gives Congress the right (and the power) to regulate commerce with foreign nations and between states. Your hypothetical trade of arms with Iran is commerce with a foreign nation, and the Congress has every right to regulate that commerce. You cannot argue reasonably for unrestricted and unregulated trade without also arguing that the Constitution is void, because the Constitution clearly gives Congress the right to regulate trade. I also happen to know that you do believe that the Constitution is void, because you mentioned on your blog (http://anarcap.blogspot.com/) that you were burning your "Cato pocket Constitution" and replacing it "with a real pro-freedom guide: Champions of Freedom from the Mises Institute."

Coming from that standpoint, your posturing is contradictory because you believe the government can restrict trade during time of war, but that the government itself is based upon a void document and doesn't have any power at all. So which is it? Do you believe the government can restrict trade during war, which means they can restrict trade at any time, or do you believe the government shouldn't even exist?

*"this" being the United States.

Re:Violation of my rights

[dada21]

I'm surprised with your oversimplification of the concept of freedom. Saying we can form a militia to protect ourselves is irresponsible. One of the historical reasons for government is to protect its citizens from enemies both forgein and domestic.

I agree with you! A militia is a great way to keep our people strong and able. A militia prevents us from running around the globe trying to instill through force a system that came through voluntary cooperation (over time). Government is supposed to defend our borders, yes, but they're doing the opposite -- they're attacking hundreds of countries (TODAY) and the People are hated all over the world.

I would argue that declaring math of any kind as a munition is silly, but your argument about that government doesn't have an obligation to try to protect us against dangerous information being transferred is equally irrational.

This is the slippery slope towards censorship and tyranny. Once information is printed on paper and in the eyes of a few dozen people, consider it not top secret any longer. In fact, I believe that our government should be 100% transparent to the People, and this means having NO secrets in government. Our most secret weapons have fallen into the hands of enemies through our government's backdoor deals. Remember Iran-Contra? Remember Afghanistan-Russia? We did that, our government, us. It is fair for a government of the People to trade with the enemy, but not the People? Huh?

By your standard, it would be okay to give information to a foreign entity that has openly declared hostilities against the United States. I encourage you to continue to fight for freedom, but doing so blindly, without considering the complexities of an international community is damaging to the cause of freedom

The foreign entity hates us for our actions against people they are aligned with. I would expect no less.

I do business all over the world, and am starting a business in Dubai and in Eastern Europe. These "enemies" don't hate freedom or Christians or MTV, they hate the hundreds of thousands, maybe millions, of murders we committed in the name of our People. If you've never BEEN to the Middle East or Eastern Europe, don't even start with an opinion that isn't based on facts.

Re:Violation of my rights

[twiddlingbits]

You are so ignorant it's amazing about so many topics. You obviously don't know history or geo-poltics worth a dam. I have done business in the Middle East and have friends from that region. The nations of the Middle East want American dollars, technology and business interests. If it makes them a buck they don't give rat's ass what your religous beliefs are, but if you EVER say anything negative about THEIR beliefs or contradict something they say about YOUR beliefs you are gone. Your business will dry up in a heartbeat. Business over there is "thier way or the highway" and "ethics smethics". You get tight with the right guy (The Sheik) by making the right promises and you get great results (of course you have to hire HIS people, not the best qualified ones), don't do/say the right things and you'll never see a dollar of profit. Many of the most radical Islam groups DO hate Freedom, MTV and Christians...go read the passages in the Koran about "infidels". Right now Eastern Europe is safe but maybe not for long. I guess you forgot about the war in Bosnia between Christians and Muslims, the 20+ year war in Lebanon between Moslems and Christians. I won't even go into your idiocy about free speech. You really SHOULD be on the Watch list, you sound a lot like some of the OKC terrorists in many ways.

Re:Violation of my rights

[dada21]

Your definition of speech is somewhat all-encompassing. If I were to want to "express" myself by taking pictures of naked children (without their knowledge, perhaps) and display them on billboards throughout the country your argument would permit that. You base your argument on some sort of arbitrary freedom that you think you have as a member of this country. Nowhere in the Constitution are you granted that freedom.

You picked one of maybe 5 places where I don't have a good response -- yet. I do believe that if you are taking secret pictures of naked children on your property, you likely DO own the right to those pictures. In my free market utopia (note that I don't believe in utopias), I would have to say that I would not take my children onto anyone's property without an agreement that they won't be taking private video, pictures or record our conversations. I understand that this isn't a perfect reply, but the naked children picture taking debate comes up SO OFTEN that I continue to work on my reply :) In the Constitution, a property owner DOES have the right to take pictures of anyone on that property without warning. See the 9th and 10th Amendments.

In fact, the Commerce clause gives Congress the right (and the power) to regulate commerce with foreign nations and between states

Wrong. The Commerce clause was written specifically to prevent the individual states from restricting trade. The original founders never intended Congress to restrict trade -- in fact, most of them actually said that we should never have alliances or entanglements with other countries. Trade with all, prosper with all. The Commerce clause is badly abused.

I also happen to know that you do believe that the Constitution is void, because you mentioned on your blog (http://anarcap.blogspot.com/) that you were burning your "Cato pocket Constitution" and replacing it "with a real pro-freedom guide: Champions of Freedom from the Mises Institute

I'm pro-Constitution, actually, but I am anti-State. I made that comment because Cato aligns themselves with the Constitution on their face, but behind your back they attack it at ever chance they get, it seems. A Constitution published by Cato is worthless, in my opinion, unless that Constitution is upheld as the true letter of the law for government.

Coming from that standpoint, your posturing is contradictory because you believe the government can restrict trade during time of war, but that the government itself is based upon a void document and doesn't have any power at all. So which is it? Do you believe the government can restrict trade during war, which means they can restrict trade at any time, or do you believe the government shouldn't even exist?

You are 100% correct -- in some posts I actually will say (and the end) that I don't believe in the State and am only posturing for those who do.

If our citizens want a Constitutional government, they should stick to it, and I will listen. If they don't want one, I will live outside of the law and outside of their rules. The citizens need to make a decision, so I know how to live, but they can't.

I will never accept a government that fights undeclared wars. If we could agree to a truly Constitutionally-limited government, I WILL accept a government that defers to the minority decision of an individual except when that individual commits an act of physical force against another person, or violates a contract.

Sorry for the confusion, thanks for holding me to my beliefs :)

Re:Violation of my rights

[belmolis]

I'm no fan of US foreign policy, but are you smoking crack? What 500,000 children has the US murdered in the Middle East? And in any case, al-Qaeda is quite explicit about the reasons for its actions and it has said nothing about any 500,000 murdered children. It wants and end to US presence and influence in the Muslim world, especially Saudi Arabia.

Re:Violation of my rights

[Main Gauche]

"I do remember 9/11. ... Afghanistan did not attack us."

You certainly have an interesting perspective on things.

"I don't see how one attack killing 3000 people ... should infringe on my right to trade with whomever I want"

Yes, it's awfully convenient to partition the world into so many parts that no single thing has anything to do with another. Now back to reality: that's just not how things work. The world is a complicated place. Issues cannot always be separated from each other, and they are not simply black and white. Unfortunately, the rest of the world stereotypes my fellow Americans as seeing the world as such; and unfortunately the sterotype is too often right.

E.g., elsewhere you wrote:
"When we declare war against Iran, I'll accept a closing of trade. Then, and only then, will I have a concern about Iran."

and before that (in a modded up post !?):
"I should be able to trade with whomever I want to trade, without restrictions by the State. That's what freedom means."

I'm sorry to point it out, but this is exactly what I am referring to. Absolutes. Black and white. "Trade if and only if no war." The world simply does not function that way.

MG

Re:Violation of my rights

[NDPTAL85]

Why would I want to form a militia? That would take up a lot of my own time and prevent me from pursuing the career and hobbies of my choosing. A professional military provides defense and free time for all. In addition to that, 50 small militias can't provide the same amount of force as one federal military can.

Characterizing a serviceman as a "cruel murderer" is extremely out of order. Coupled with your unhealthy fanatical reverence for strict constitutional constructionism I'm just going to have to conclude that you are not of sound mind.

Re:Violation of my rights

[meinders]

If some madman uses a Windows password cracking tool to steal a password and hurt someone, it is called trespass and there are already laws governing it.

Unless you... or me... or i assume hundreds of others have been hacked from a source overseas, where telling the police isn't going to do ANY good. What jurisdiction do they have? None.

Re:Violation of my rights

[Martin Blank]

A group of people angry over the presence of infidels on Saudi Arabian soil, close to Mecca and Medina, attacked us. The death of Iraqis in the embargo (which itself was largely due to the diversion of resources by Saddam Hussein, and not through 'attacks') was an after-thought that was thrown in to gain wider support in the Arab world. (Even factoring in the deaths during the Gulf War, military attacks likely did not cause more than about 25,000 deaths, military and civilian, and the civilian death count of 2300 may have been inflated by Iraq at the time.)

Afghanistan was attacked because the de facto leaders of that country refused to hand over those who planned and orchestrated the 9/11 attacks.

Your basic view that government should be hands-off is certainly valid, but please try to base the view on actual facts, and not on distortions or outright fallacies.

Re:Violation of my rights

[Bastard of Subhumani]

Americans have the right to arms. Defend yourself. Form a militia in your town.

1776 called. They want their tactics back.

Re:Violation of my rights

[AvitarX]

I finally understand thank you for your explanation.

We must restrict the export of boxcutters and plane tickets.

Just to be careful we should extend the same restrictions to stuents and citizens too. In fact, we shhould probably require special clearance for the purchase of plane tickets and box cutters, only then will I be able to sleep at night, the fact that terrorists can bring safty siccors and mustach trimmers realler has be on edge.

Re:Violation of my rights

[dada21]

Really?

I don't do business with the Sauds, I said Dubai. Dubai is the most free city in the world.

The pro-State Middle East regime want US dollars as the Fed inflation funds the Middle East policy. Many Middle East company prefer gold and other currency over the US dollar in recent months.

My business is signing into long term agreements. I am 100% open and honest with my customers about my beliefs, and they like it. You work with going contracts, I bet. I work to find the loopholes.

Many of the most radical Islam groups DO hate Freedom, MTV and Christians...go read the passages in the Koran about "infidels"

Half my family is Muslim. Your states is a blatant lie. Dittoheads crow the same mantras, I guess.

When the USD crashes and oil prices hit US$85/bbl, you'll change your tune.

Re:Violation of my rights

[Hognoxious]

If you were to sell plans for a gun to someone, and then someone used the plans to make a gun, and then committed a crime using it, who is at fault? The modern approach is to blame both.

If you sold in the knowledge that he was going to commit murder with it, I think that approach would be correct. Look up "accessory".

Re:Violation of my rights

[Hognoxious]

In the Constitution, a property owner DOES have the right to take pictures of anyone on that property without warning. See the 9th and 10th Amendments.

I call bullshit. People have been prosecuted for hiding cameras in changing rooms etc.

Re:Violation of my rights

[Homology]

I'm no fan of US foreign policy, but are you smoking crack? What 500,000 children has the US murdered in the Middle East? And in any case, al-Qaeda is quite explicit about the reasons for its actions and it has said nothing about any 500,000 murdered children. It wants and end to US presence and influence in the Muslim world, especially Saudi Arabia.

What the poster reffered to is the children that died because of brutal and murderous sanctions (medicines unavailable because of those sanctions etc etc). Former US Secretary of State Madeleine Albright (under Clinton) was once asked if all those dead children was worth it, and she said yes.

Re:Violation of my rights

[CaymanIslandCarpedie]

it has said nothing about any 500,000 murdered children. It wants and end to US presence and influence in the Muslim world

And you think the two aren't related? In a nutshell (and in /. format), here is the history of US involvement in the Middle East:

1) Fund/Support corupt and brutal regimes as long as it fits US agenda in the region.
2) Regime breaks from US control.
3) US kills thousands of innocent people in process of "liberating" them from that regime.
4) $Profit
5) Repeat steps 1-4

Re:Violation of my rights

[aaronl]

In that situation, then I agree with you. You would have helped to orchestrate a crime, so you are accessory to that crime; you were a knowing participant. The act of sale is still not the crime, but, rather, the act of helping to commit a crime.

Re:Violation of my rights

[SpaceLifeForm]

If it makes them a buck they don't give rat's ass what your religous beliefs are, but if you EVER say anything negative about THEIR beliefs or contradict something they say about YOUR beliefs you are gone. Your business will dry up in a heartbeat. Business over there is "thier way or the highway" and "ethics smethics".

Sounds like the bush administration.

Re:Violation of my rights

[Khabok]

Maybe true, and definitely a little cute, but entirely lacking in good sense. Whatever they happen to hate, the thing that really gets them pissed is when we try to give them these things militarily. Do they hate freedom, Christians, and MTV? What about Jews, Atheists, Buddhists, and the rest? Then let them close their wallets. Hell, let them close their borders if they like. Whenever a nation gets to feel comfortable on its own soil and nothing blows up, everybody is a winner.

The question about restriction of US trade is essentially the question of where we're allowed to look for alternative opportunities when any particular group decides to make things tough for us. You're right, the USD is good stuff over there. If it's all going to Afghanis instead of Saudis, chances are the Saudis are going to start thinking about changing their game. They're capitolists over there too, you now.

You seem to have taken a very cynical opinion, but allowing businesses such as your business to take their operations and their money elsewhere is exactly how to improve your situation.

You really SHOULD be on the Watch list, you sound a lot like some of the OKC terrorists in many ways.

And you called him ignorant...

Re:Violation of my rights

[belmolis]

Right, I think the two are not related. In fact, I'd say the evidence is overwhelming that Al-Qaeda is not motivated by the casualties resulting from US intervention in Iraq since Al-Qaeda's major actions preceded the US invasion of Iraq. Nor does Al-Qaeda care about US support for oppressive and corrupt regimes. Al-Qaeda is fine with oppressive and corrupt regimes as long as they are, by Al-Qaeda's criteria. Witness the Taliban.

Re:Violation of my rights

[belmolis]

Well, if that's what the poster meant he should have said so. I agree that the sanctions were probably ill-advised, but they did have exemptions for food and medicine. The fact that Iraqi children didn't get needed medicine is due largely to the fact that the money intended for them was diverted by Saddam Hussein and his buddies.

Re:Violation of my rights

[Anonymous Coward]

1777 called. They want their freedom back.

Re:Violation of my rights

[twiddlingbits]

When you have dealt with the Saudis, UAE, Dubai, and Quatar on mutlimillion dollar deals as I have, then you can talk. They want the USA only when it is to thier benefit, if it is our idea then things stall. They really value thier independance until trouble happens. I have traveled with these folks in the USA and we have talked about "issues" such as Religion, Israel and the like. They flatly told me you cannot say such things about Israel or Allah (religion) in our nation, you would get in lots of trouble and your business would suffer greatly. IMO, the best ones to deal with are in the UAE as they are quite modern but it can still be very tricky unless you know the right people.

Re:Violation of my rights

[TapeCutter]

"why do you allow your government to make these victimless-crime laws?"

It's not just the US and not just recently, most of the western world has had similar restrictions since the days of Turing and WW2 (refer to the U-boat fleet and the battle of Midway for the victims of weak crypto). Very few paid attention until communications went digital and the algorithm behind modern public-key encryption was discovered, before that crypto codes were "crackable" using statistical techniques (given enough data).

Once the math behind the "uncrackable code" was known to the public the genie was out of the bottle and these laws rapidly became antiquated and pointless. At the moment nobody has an advantage via crypto, if a practical method of factoring large numbers was found public-key would be useless. I'm sure the spooks would be stomping over any replacement method discovered, after they shot the maths nerd who managed to crack public-key. "Knowlage is power" and their bosses are in the power business.

Re:Violation of my rights

[CaymanIslandCarpedie]

Al-Qaeda is fine with oppressive and corrupt regimes as long as they are, by Al-Qaeda's criteria

True. But this is equally true of the US. Lets not forget that Al-Qaeda was started, funded, and supported by the CIA during the Soviet's war in Afganistan to fight the communist envasion.

Hey, I'm not saying Al-Qaeda is good. Hell, I think they are probably one of the most horrible organizations in recent history but that just shows how (arguably more so) horrible our actions have been in the region. We created them 'cause at the time we felt is was in our best interest. Now we have to go back and kill tons of innocent people in an effort to stop what we created.

My whole point is this: Your average muslium, arab, or whatever group you want to lump them in didn't just wake up one day see American women driving on Al-Jazera and say "I hate thier freedom!!!! I must go kill them!!!". Its the US's own HORRIBLE policies in the region that earned them that hatred.

And its not like these horrible policies are confined to the past. What gives the US the right to say "we must fight them over there so we don't have to fight them here"? Because of thinking like that how many tens of thousands of innocent muslum, persian, arab, etc have died by US actions so that we might or might not stop an attack which may or may not happen and which if it does may or may not kill a large number of people? Taking such pre-emptive strikes be it for fear, greed, or to "re-shape the region" (huburis) is equally wrong and against everything I thought America used to stand for.

Piracy

[Gr33nNight]

In other news piracy of crypto applications have risen dramatically in non-US countries.

Really now, do they think if they just dont sell it that it wont end up in the hands of those who they dont want to have it? Please.

Re:Piracy

[pembo13]

Well of course. Hasn't that worked before?

Re:ITAR Revisited? cryptanalytic? What a Joke!

[Anonymous Coward]

brute forcing passwords is nothing like an encryption algorithm, what the hell is really going on here?

Now...

[wishbone]

All your Cyphers are belong to U.S.

Re:Now...

[joey_knisch]

Except the ones that matter and are now open source.

Breaking 4096b RSA would take the lifetime power output of entire universe... Or something like that.

Time to sing...

[dpbsmith]

Die Gedanken sind frei
My thoughts freely flower,
Die Gedanken sind frei
My thoughts give me power.
No scholar can map them,
No hunter can trap them,
No man can deny:
Die Gedanken sind frei!

I think as I please
And this gives me pleasure,
My conscience decrees,
This right I must treasure;
My thoughts will not cater
To duke or dictator,
No man can deny--
Die Gedanken sind frei!

Are you listening, Dubya?

Re:Time to sing...

[meringuoid]

My thoughts will not cater to duke or dictator no man can deny-- Die Gedanken sind frei! Are you listening, Dubya?

Your song sounds subversive. Your name has been added to the aviation watch list. Have a nice day, citizen.

Re:Time to sing...

[Tackhead]

> I think as I please
> And this gives me pleasure,
> My conscience decrees,
> This right I must treasure;
> My thoughts will not cater
> To duke or dictator,
> No man can deny--
> Die Gedanken sind frei!

"The thought police would get him just the same. He had committed--would have committed, even if he had never set pen to paper--the essential crime that contained all others in itself. Thoughtcrime, they called it. Thoughtcrime was not a thing that could be concealed forever. You might dodge successfully for a while, even for years, but sooner or later they were bound to get you."

>Are you listening, Dubya?

"SMITH! SMITH, D.P.B., 263124! Yes, you! Bend lower, please! You can do better than that. You're not trying. Lower, please! That's better, citizen. Now stand at ease, the whole squad, and watch me... Anyone under forty-five is perfectly capable of touching his toes. We don't all have the privilege of fighting in the front line, but at least we can all keep fit. Remember our boys on the Iranian front! And the sailors in the Freedom Fortresses! Just think what they have to put up with. Now try again. That's better, citizen, that's much better"

Re:Time to sing...

[hpulley]

Ein Penny für Ihre Gedanken...

Good News/Bad News

[sunderland56]

Bad news: I can't buy a copy of LC5.

Good news: According to another Slashdot story, I can download one for free from a French web site!!

Re:Good News/Bad News

[operagost]

That's amusing, because any useful encryption is illegal in France unless the government holds a backdoor key.

USA > FR

Re:Good News/Bad News

[Billosaur]

Good news: According to another Slashdot story, I can download one for free from a French web site!!

Bad News about Good News: Until that actually comes to pass (and there is some doubt), you may in fact be pilloried.

Re:Good News/Bad News

[aaribaud]

This is plain wrong. Any individual can use crypto in France, no matter how long the key (pardon my French, and happy babelfishing).

Re:Good News/Bad News

[operagost]

Thank you for the correction. It is a shame that the 1998 law still restricts businesses that use anything over 128 bits.

Re:Good News/Bad News

[Lehk228]

Mininova has it too, i just snagged it about 3 minutes ago

Maybe it provides an excuse for something

[Anonymous Coward]

Nobody would be stupid enough to think it is possible to keep a commercial product out of foreign hands. Maybe making it illegal to export this product is just a way to provide an excuse for search/wiretap warrants.

Since I think the administration is at least semi-intelligent, I am looking for the ulterior motive.

Re:Maybe it provides an excuse for something

[Anonymous Coward]

It's unconstitutional, exactly what we have come to expect from the current regime.

Where's the legal crack when you want one

[That Paranoid Twitch]

What's left for those of us with bad memory, or mongrel mates who change passwords, back to outsourcing the product from the US or maybe Canada. Or just getting a mate over there to crack it post it somewhere online.

Re:Where's the legal crack when you want one

[Barny]

Get yourself the EBCD (*sigh* google it if u want to DL it) and just remove the password lock from that account.

The only time you need to crack the crypto is when the box is remote or can't be restarted.

Re:Where's the legal crack when you want one

[That Paranoid Twitch]

Good point

Re:Where's the legal crack when you want one

[trianglecat]

Well... here and here off the top of my head.

Marketing....

[pegr]

Well, since ITAR is no more, why would @stake do this? Marketing, of course! "Our product is so good, we can't sell it to just anyone!" Balderdash... Anyone in the biz knows that LC is obsolete anyway. Don't believe me? Google "Rainbow Tables" and see for yourself...

If you just have to have an automated tool for hash cracking, skip LC and do SamInside. Same functionality, cheap, no copy protection, and integrates with Rainbow Tables as well. Hey Mudge! Still think selling out was a good idea?

laughable

[eyrieowl]

hey, the government is just worried that scary e-terrorists that don't know how to download the software for free will break into the dept. of homeland security and compromise the sensitive windows 95 network they've got running.... i, for one, feel safer already.

LC5 - L0phtCrack

[spacerog]

It is quite a shame to think of what could have been only to see what has become.

Yeah, I know, I'm partly at fault. Still, things could have been great.

But hey, we were all just a bunch of FBI Snitches anyway. Which if true means that there is probably a secret back door in L0phtCrack and still in LC5 that transmits all cracked passwords direct to the FBI so that they can get into any server anywhere. Of course if that is true (and of course it is) DHS and Symantec should actively promote the use and distribution of LC5. All the more passwords they can get. Whatever.

- Space Rogue
L0pht Heavy Industries
Whacked Mac Archives
Hacker New Network
Sell Out
FBI Snitch

(Pay no attention to this rambling bitter old man.)

Dark days indeed.

[merc]

What sad times are these when passing ruffians can say 'Ni' at will to old ladies. There is a pestilence upon this land. Nothing is sacred. Even those who arrange and design cryptographic software are under considerable economic stress at this period in history.

Re:Dark days indeed.

[Viol8]

"Ni"? Are these polish ruffians then?

OR

[TubeSteak]

From TFA

"I guess I'll just have to go back to using John the Ripper."

JTR + Rainbow Tables = Teh Shit

http://rainbowtables.shmoo.com.nyud.net:8090/
Bittorrent to Download.

FYI
Alpha-Numeric and 14 Symbols = 11 GB
All Characters and the Space Character = 43 GB

It helps if you have enough RAM to load each 700MB section of table into memory. The longest part of this process (for me) is waiting for my puter to finish reading the tables off the DVD I burnt them too.

BTW- If something is illegal for export, that means the only people who will get in trouble are the exporters, not the people 'illegally' obtaining software.

Hell, if it's illegal to export something, is there any reason to buy it? If you don't do business in/with the U.S or Canada, what is the gov't/company going to do if you pirate unexportable software? Sue you for violating their copyright?

ironic.

[Lumpy]

cince it was probably written in the former soviet union.

Almost ALL the good pro cracking tools for passwords come out of the former USSR. We purchased a suite of them to crack documents and databases for use her at work and they work fantastically.

Re:ironic.

[Myrcurial]

Your low user id made me think that you might be clueful. L0phtcrack was developed in the USA by a bunch of bright boys in the north-east. Sheesh.

Those who don't study their history are doomed to repeat it. Please review the history of Germany, 1930-1939. Thank you for showing up.

Re:ironic.

[Lumpy]

I did not realize that their product was based on L0phtcrack. Oops my bad. Although there are still GOBS of identical tools available outside the USA that do just as good of a job.

Re:ironic.

[Myrcurial]

Not just based on the work of the boys from boston -- is the same bleeping product -- Symantec bought @tstake.

Oh, and if you're in Canada - you can't buy it there either. We tried.

Oh come on...

[Noryungi]

I travel regularly between the USA and Europe... What's to prevent me from buying several copies of this tool and take them back with me to Europe? Do you think Symantec and/or the shop owner will ask me for my passport before selling me this software?

For that matter, there is a good chance that there are mirrors and/or legal copies of this tool in Europe already. So what's the point? This type of restriction is ridiculous.

Oh, and by the way, I have a copy of O'Reilly's 'Knoppix Hacks' on my desk somewhere. I think there is a recipe in that book to remove or replace the administrator password of a Windows machine using Knoppix. Again, what's the point behind this restriction?

Re:Oh come on...

[garcia]

I travel regularly between the USA and Europe... What's to prevent me from buying several copies of this tool and take them back with me to Europe?

The TSA/customs. Remember! We are fighting the terrorists on many fronts including right here on our "homeland". Everyone in the government must do their part to stop those that are aiding terrorism.

If you think I'm joking, you're unfortunately only half right.

Re:Oh come on...

[Barny]

Theres customes, if they find things in your luggage that are not allowed to leave the country, they will do nasty things :)

But yes, its stupid, code should be "free" even when you have to pay for it.

As for replaceing passwords, just use EBCD, it does it all automagically for any user.

Re:Oh come on...

[ncc74656]

Oh, and by the way, I have a copy of O'Reilly's 'Knoppix Hacks' on my desk somewhere. I think there is a recipe in that book to remove or replace the administrator password of a Windows machine using Knoppix.

It gets even easier than that. Just grab this, put it on a floppy or CD-R, boot it, and follow the prompts. IIRC, the current version works with everything up to at least WinXP SP2. It'll unlock any account and clear the password; after that, you can boot normally and set whatever password you want.

Re:Oh come on...

[supabeast!]

"So what's the point? This type of restriction is ridiculous."

This type of restriction is great politics. It gives all those Senators and Congresscritters something to take back home to the bible belt and show off. Do you really think that all the people out there stupid enough to believe that an invisible man in the sky wished the universe into being, simply because a collection of fairy tales says so, are going to rationalize that crypto export restrictions are good for anything other than hampering the ability of American businesses to compete with foreign businesses?

Re:Oh come on...

[optimus2861]

I think there is a recipe in that book to remove or replace the administrator password of a Windows machine using Knoppix.

Shameless karma-whoring, coming right up:

Emergency Boot CD. Has a Windows password-reset tool on it. Run it, shows you the list of accounts, pick one, reset its password to anything you want.

So, anyone care to start a pool on how soon the US requests my extradition for posting that?

Re:Oh come on...

[jZnat]

At least resetting the passwords on a Mac are easier. Just hold s (or was it cmd+s?) on boot-up to boot into su. From there, just passwd yourself some new passwords. :)

Personal question for Space Rogue

[rewt66]

Do you feel like a sellout for, well, selling L0pht to Symantec? Or are you just bitter at being labeled a sellout for doing so?

(I worked for Symantec for 4.5 years. The money was really nice, but I didn't feel like I sold out to get it...)

Re:Personal question for Space Rogue

[drwho]

Hi Chris (Space Rogue)! and to rewt66, SR left @Stake a long time ago. He had nothing to do with Symantec.

I think what Symantec has done to @Stake is sad, really sad. They're sitting on some really cool software technology and not doing anything with it. My guess is that the same heebie-geebies that make them do export restriction on L0phtCrack (a.k.a. LC5) are making them sit on this decompilation technology.

I'd say that I'd like to see l0pht reborn from the ashes, but differently. Hasty Pastry is close to it, and I am glad I was able to my part and start it, and sad I couldn't afford to stay involved. But I think that more than HP is needed. Hasty Pastry is specifically non-commercial. L0pht become overly commercial. There needs to be something that's commercial but not a part of The Machine. A place where there's both money and fun. But that's not going to happen in Boston, this city has become too expensive.

Re:Personal question for Space Rogue

[blincoln]

Do you feel like a sellout for, well, selling L0pht to Symantec?

I'm sure that when you sell your company for a swimming pool full of cash, you automatically earn the ability to drown any such feelings in a sea of hot girls/boys and recreational psychoactives.

Re:Personal question for Space Rogue

[spacerog]

Both.

I wasn't around when @Stake was bought by Symatec. I was around for L0pht's sell-out to @Stake.

There were two issues back then, one we were greedy, we all were. We all saw $$ signs and ran towards them. However it wasn't just the money (Which really there wasn't that much of but some of us got more than others.) We had grand visions, "Make a dent in the Universe" and all that. We were niave and believed them. It took me a few months to see the writing on the wall, then HNN got canned and I saw the @Snake for what it was.

I sit here and wonder what could have been. At the time L0phT was pretty much self sufficient and growing. But I hvae no one but myself to blame, well for most stuff. Ah, well, like I said nothing but the memories of a bitter old man.

- SR

Re:Personal question for Space Rogue

[Anonymous Coward]

Let's be honest here, Symantec is a machine which only exists to make profit. This story has less to do with export restrictions and more to do with image and finances. @stake was bought for the consulting practice and not for the products. Products that don't bring in 100M per year just aren't worth it for Symantec. LC5 has the added value of export headaches *and* a crazy name with the word crack in it. Why do you think it's LC now instead of l0phtcrack? The decompilation software is the same story. While it is one of the coolest technologies I've seen in the last five years there is a very low chance Symantec can make 100M with it. I never got to see the hey day of l0pht and arrived at @stake when it was a fully corp machine with very liitle "cool" left in it. Selling us all off to Symantec was just the final nail in the coffin.
That being said I think the HP is one of more hopeful projects in the area. But as soon as you inject cash flow it could just as easily go the same route. Money changes everything and everyone involved. The only way to keep it pure is to keep it a tight cabal and never allow the greed of venture capitalists to enter the equation.

zero

Re:Personal question for Space Rogue

[jonwil]

Does anyone have any links or info on this "decomplation technology" and what it actually would be able to do (if it was ever released)?

Re:Personal question for Space Rogue

[Anonymous Coward]

Does anyone have any links or info on this "decomplation technology" and what it actually would be able to do (if it was ever released)?

Nope.

Won't stop them

[jpsowin]

So instead of having the opportunity to buy it, they will pirate it. Doesn't seem very effective. If they would let them buy it, they would also have records of people who have bought it.

Re:Won't stop them

[corpsiclex]

The people who buy and pay for LC5 aren't the ones using it for Bad Stuff (TM). Such a list would be useless anyway

Hasty Generalization

[Anonymous Coward]

"Back in the day, crypto was classified as munitions under ITAR."

It still IS controlled (US Department of Commerce) and has been for a while; check your facts.

"foreign companies are perfectly able to develop their own products"

That is not the point. The point is that you don't want US companies AIDING foreign companies in creating cryptography systems to which the details are not known. Yes, I know, the strength of crypto lies in the mathematics not how it is done (read source); but having the algorithm details is also important.

Re:Hasty Generalization

[Bastard of Subhumani]

The point is that you don't want US companies AIDING foreign companies in creating cryptography systems to which the details are not known.

Surely if US companies created it the US authorites have more chance of finding the details than if it's written by an Indian software house or a Latvian teenager?

Re:Hasty Generalization

[idontgno]

but having the algorithm details is also important.

The only cryptosystem protected by hiding the algorithm is a weak one. Strong systems flaunt their mathematical foundations, daring all to attack them--and survive that rigorous, even hostile, examination.

Coddle the weak and guarantee pwnage. The weak system, used unquestioningly, will fall easily to black-box examination of ciphertext or other system artifacts. And the users will not know!

Re:Hasty Generalization

[Anonymous Coward]

Seriously, what the hell did I JUST SAY?
Now I know why there are reading comprehension tests.

1) Mathematics are more important
2) Algorithm details can be of some use to know
      1) what you are dealing with
      2) how sound it is

"Strong systems flaunt their mathematical foundations"

Yes, and some systems that were considered "strong" previously have have now been proven otherwise.
But the simple fact of the matter is that it makes things more complicated if you don't know whether you are dealing with, say, large prime numbers or elliptical curves.

"The only cryptosystem protected by hiding the algorithm is a weak one."

Yet this does not insure that all cryptosystems with hidden algorithms are weak.
Nor does this insure that weak algorithms are not successful in use.

Imposed?

[HardCase]

Although the Reg article claims that Symantec appears to have had the restriction imposed by the government, both Symantec and the Register seem to have things a little bit wrong.

For starters, section 5A002 of the ECCN covers hardware. Perhaps Symantec meant section 5D002, software. 5D002.c.1 covers their situation. But the list of restricted countries hasn't changed for quite a while - it's the usual gang: Syria, North Korea, Sudan, etc. It seems to me that Symantec is being a little lazy here. Yes, they have to have an export license to sell the software outside of the US, but the restrictions aren't any more onerous than they were in 1999, when the EAR was updated to move cryptographic software from munitions to commerce.

Oh, and this "news" is almost a month old.

-h-

Re:Imposed?

[mpapet]

Mod parent up.

Having personally gotten a crypto product approved for export, this fellow is right on.

What's interesting to me is this is most likely a "business decision" more than anything else. A Suit at Symantec put a stop to this potentially evil tool for no other reason than it's too small potatoes for them to deal with the risk of it being used by bad non-Americans versus the sales numbers.

What this also suggest is there's a bit of a figurative "circling of the wagons" at Symantec. It suggests very hard times coming to Symantec.

In America, the Americans spy on you!

Re:Imposed?

[illumin8]

But the list of restricted countries hasn't changed for quite a while - it's the usual gang: Syria, North Korea, Sudan, etc.

Sure, because there's no possible way that any of those evil hackers and terrorists could get a copy without buying it from Symantec.... [snicker]

Yet another stupid law that only penalizes people that actually obey laws in the first place. Hackers will just download a copy off of BitTorrent and be done with it.

Re:Imposed?

[HardCase]

Sure, because there's no possible way that any of those evil hackers and terrorists could get a copy without buying it from Symantec.... [snicker]

Well, no kidding, Captain Obvious, but that wasn't the point of my post. Let me try again. The Reg claims that Symantec can't sell the software outside of the US and Canada because the government imposed a regulation on them. Not true. Symantec claims that a certain section of the EAC prohibits them from selling overseas. Not only not true, but they cited the wrong section.

Symantec appears to be incorrectly using the EAC as an excuse for lazy business practices.

-h-

Re:Imposed?

[0-9a-f]

So what? You're suggesting that Symantec is being blocked by US export restrictions because they haven't bothered to renew their export license?

Seems the other way round from how 99% of the other comments read, including the summary at top. To read those, you'd think that it's the export laws themselves that had changed. Or that Symantec are hiding something (cue the conspiracy theorists).

Re:Imposed?

[HardCase]

So what? You're suggesting that Symantec is being blocked by US export restrictions because they haven't bothered to renew their export license?

Seems the other way round from how 99% of the other comments read, including the summary at top. To read those, you'd think that it's the export laws themselves that had changed. Or that Symantec are hiding something (cue the conspiracy theorists).

I'm not suggesting that Symantec is being blocked. I'm suggesting that if they want to sell their product outside of North America all that they need to do is obtain an export permit.

I guess that I'm not sure what you're trying to say here. Yes, what I posted is 180 degrees out from 99% of the other posts and the summary, but that's no surprise.

-h-

Re:Imposed?

[tepples]

I'm suggesting that if they want to sell their product outside of North America all that they need to do is obtain an export permit.

But wouldn't Symantec have to apply for a separate export license for each end user?

Re:Imposed?

[HardCase]

But wouldn't Symantec have to apply for a separate export license for each end user?

Nope. The license is for the product.

Always look on the bright side of life! o/~

[Caspian]

Symantec's restrictions recall the dark days of the crypto wars when users outside the US were not entitled to buy products featuring strong ciphers.

No they don't! This time, Canadians can buy them too!

Re:Always look on the bright side of life! o/~

[digidave]

"No they don't! This time, Canadians can buy them too!"

Yeah, but we're all raging terrorists up here. You guys are *so* screwed now! We've been waiting years to be able to crack your Windows passwords, but now that we can buy Symantec software we can finally bypass the Win98 login screen on all the covert CIA workstations.

Muhahahaaaa

Re:Always look on the bright side of life! o/~

[dadragon]

I believe we could before too. It's jus that the government realises how hard it is to NOT export things to Canada, what with there being no wall between us and all...

Mysterious: perhaps this is why?

[Mostly a lurker]

I have carefully read other people's comments, and noone can come up with a rational explanation so I shall try.

Let us suppose the NSA wants you to put backdoors into your security products and you refuse, what leverage does NSA have? Well, perhaps they might put commercial pressure on the company to comply: by refusing to allow them to sell the product until they do.

I am not sure this is the real reason, but it seems possible.

Re:Mysterious: perhaps this is why?

[jcnnghm]

Mystery is the leverage the NSA has. It's kind of hard to say what they would do, but the sky is basically the limit as far as what they could do. I think a couple of guys in a black SUV conspicuously following someone around for a couple of weeks could convince them to go along with it.

Re:OLD!!!

[Barny]

There is a way for it to be put on /. without going through the front page?

Doomed to failure

[Archimboldo]

I can see restricting something not already overwhelmingly in the public, such as an F22/A fighter, but a commercial product that is easily duplicated? That's dumb. Anyone can easily get a copy illegally or, with some trouble, some smart people can make their own.

All this does is hurt companies like Symantec.

For the most part, I'm not a Bush hater, but I think this is unrealistic and short-sighted.

Arrogance?

[Goth Biker Babe]

The export ban always made me laugh because it arrogantly assumed that no one outside of the US/Canada was capable of developing their own encryption technologies.

This is something that British Secret Services have used to their advantage. Public key encryption technologies were developed at GCHQ in the early 70s but unlike the US, they didn't tell anyone until recently so they could use it without anyone knowing.

Something similar was done with Enigma. The fact that Enigma had been cracked was kept very quiet so that Enigma machines could be sold by the Brits to foreign governments after the war and we could listen in! News that we invented the World's first electronic computer was also kept secret for the same reason.

Re:Arrogance?

[fjf33]

And the end result is that the brits lost the lead in both technologies. At least were it matters which is the public corporation. All the IP and money out this was made for a long time by American corporations almost exclusively. Ohh well, at least the island is safe.

Re:Arrogance?

[Red Flayer]

"Something similar was done with Enigma. The fact that Enigma had been cracked was kept very quiet so that Enigma machines could be sold by the Brits to foreign governments after the war and we could listen in!"

No, that's not why it was kept quiet. It was kept quiet because otherwise the crack was useless in the war.

Please don't take history lessons from pop movies (Enigma, 2001). The movie Enigma was full of inaccuracies and half-truths.

Also, please don't take it from sci-pop literature (Neal Stephenson, e.g.) -- also not accurate.

Re:Arrogance?

[drinkypoo]

What, you mean Mr. Waterhouse didn't invent the digital computer?

Show me the damn packets!

[Anonymous Coward]

Show me the damn packets!
How the hell is LC5 dumping your infoz to government servers?
This is the stupidest thing I've heard.
Talk about dis-information.

Lets talk more about backdoors to actual encryption algorithms.

This will increase availability of the program

[Butterspoon]

This restriction is only going to cause the "information wants to be free" brigade to ensure that the torrents for LC5 are well seeded.

And the publicity generated by the ban (not least here on /.) will ensure that it is duly downloaded by the bucketload.

Hell, I hadn't even heard of LC5 before this announcement!

Re:This will increase availability of the program

[evilbuny]

Perhaps widespread installation was actually the real motivation with this ban? What better way to get the people to use it then telling them they can't?

four words

[martin]

stable, horse, bolted and door

Q. make a familiar phrase out of the above
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
A. Closing the stable door after the horse has bolted

Re:four words

[Chmarr]

stable, horse, bolted and door

Q. make a familiar phrase out of the above

stable bolted door horse stable door door stable bolted door bolted stable horse stable horse bolted horse horse door

Re:four words

[Anonymous Coward]

ebfd311cd6e8ec6e1c714c4cd58f3670
3d9a0ac129996697164e25f58289c3e505554bcc

Re:four words

[StikyPad]

A horse in the stable is worth two bolted to the door?

Born with a silver horse in your mouth. Next to a bolted stable door.

Four horse and stable years ago, in order to bolt a more perfect door...

They who would sacrifice a little horse for stable deserve neither doors nor bolts. (How true! Pony murderers...)

MOD THIS MAN/WOMAN UP

[IAmTheDave]

It is the Feds versus the States and the Feds versus the People

How true. Everything from the abuse of interstate commerce laws to abuse of executive privledge and secret laws are all the fed's grab for more power. There is no true state power since SCOTUS decided that fed law can trump state law.

Pointless

[The Mgt]

Those in US or Canada pay Symantec for it. Rest of the world downloads it for nothing from Bittorrent or eDonkey and Symantec doesn't get a penny.

Cracking Password With Only Physical Access

[Anonymous Coward]

astalavista carries Cracking Password With Only Physical Access (pdf) for both windows and linux, of course, with these physical access is required.

Download here :)

[rkwasny]

http://thepiratebay.org/details.php?id=3361611

export law... yeah ;)

Tech Support

[UnifiedTechs]

Finally a product I can buy with guaranteed Tech-Support in America.

Could this law be used to stop DRM?

[Comboman]

This isn't a republican versus democrat issue,... It is the Feds versus the States and the Feds versus the People. I wouldn't say Dubya (or Clinton or anyone else) is alone in violating the rights they're precluded from violating.

True enough. After all, Clinton forced the DCMA on us; is using the law to prevent the distribution of LC5 any worse than using it to stop the distrubution of DeCSS?

Which gives me an idea. Since most DRM schemes are essentially a form of strong encryption, could this "Homeland Security" law be used to prevent the export of media (DVDs, iTunes songs, Microsoft Reader eBooks, etc.) that are encoded with DRM? If someone manages to use this law to force media companies to sell their products unencumbered with DRM and restore fair use to consumers, then maybe it's not such a bad law after all.

Yawn, another bullshit screed from The Register

[Anonymous Coward]

The crypto regulations haven't changed since they were relaxed under Clinton. Either Symantec is just too lazy to follow the export licensing procedures which are unchanged, or they're trying to drum up interest for a faltering product by pretending that "the US government doesn't want you foreigners to have it,"or it could even be a crass political ploy to cause the usual fly-off-the-handle sorts to rant against some imagined sin of Bush.

It's quite difficult to take The Register seriously when they post articles such as this. So many of The Register's articles are breathless screeds of the form Civil Liberties to be Abolished in the USA, Film at 11. Remember that the UK has oppressive laws (e.g., the Official Secrets Act) that make the PATRIOT Act in the USA look like a model of civil liberties protection by comparison. I wonder if The Register is secretly funded by the propaganda arms of the UK government.

Re:Yawn, another bullshit screed from The Register

[Anonymous Coward]

Remember that the UK has oppressive laws (e.g., the Official Secrets Act) that make the PATRIOT Act in the USA look like a model of civil liberties protection by comparison.

Please try to learn what you're talking about before spouting off.

The Official Secrets Act is nothing like the PATRIOT act. It's just security clearance legislation. If you handle official secrets, you need a security clearance, and to get one, you have to sign a binding legal contract stating that you will not reveal those secrets. And if you then reveal them, you get prosecuted under the OSA.

So you're saying that the USA doesn't have any laws that say that traitors can be prosecuted? Fascinating...

If you want a simple way...

[Wierdy1024]

If LC5 is out of the question now, get something that is already outside the US of A.

For Example:
Login Password Recovery
(and it's easier to use - idiot proof in 3 easy steps!)

The above site has automatic hash extraction with a boot disk and remote instant cracking and doesn't involve illegally exporting software - no fiddling with p2p, bash shells, drivers etc. - I recon my granny could do it!

Symantec doesn't like L0phtcrack

[Millard Fillmore]

I suspect that the real reason behind this move is actually that Symantec doens't like the L0phtcrack product. I understand from an @Stake/Symantec contact that Symantec views the password-cracking utility almost like a tool of the enemy. Since Symantec is devoted to data protection, while L0pht/@Stake is more about active intrusion, Symantec would probably just as soon see some of the old @Stake products die, most especially L0phtcrack. This may be just a first step, or else Symantec bowing to pressure from foreign clients, perhaps foreign government clients.

Meh

[bill_kress]

America is pretty damn close to being irrelevant anyway. If we re-ban crypto and these technologies, it will simply give some developing nation a new economy.

How incredibly hard it was for me to get lc5.

[matthew_pang]

Hello, my name is Matthew Pang, and I live in Selangor,Malaysia.(This isnt in the U.S or canada just incase you didnt know that. 5:18pm (GMT)-Decides he wants to get lc5 (just because he saw this on /.) 5:19pm (GMT)-performs this search "http://www.torrentz.com/search_lc5_9_0_0.html" 5:20pm (GMT)-Downloads the torrent file from "http://www.seedler.org/en/iindex.x?a=info&id=1952 55" 5:21pm (GMT)-Launches Azureus and starts torrent download. 5:26pm (GMT)-Azureus completes download.Also seeing. 5:26pm (GMT)-Runs lc5 Setup 5:27pm (GMT)-lc5 setup complete,runs lc5,runs keygen and unloacks lc5 5:28pm (GMT)-Runs a dictionary attack on all password the program sniffed from the local network.Found 7 exposed accounts.2 of which are privelaged. 5:29pm (GMT)-Starts comparison against pre-computed hash tables The moral of the story: Dont restrict export.It`ll just make angry people like me run out and get it.Also making sure to save a copy to distribute to his friends.

this is beyond lame

[Anonymous Coward]

this is up there with putting tape on your windows for chemical attacks and hiding under desks during nukes. i can't believe you guys pay taxes for this. this is what your governtment has come up with to defend you against 'evil'. next up on the defense plan is a paper bag and a sign that says stop hurting me. i can't remember seeing anything in the past while that would prevent someone from actually commiting some form of terrorism. at this rate, Hollywood will have stopped all forms of movie piracy long before the US manages to secure itself.

TSA/Customs? Don't make me laugh...

[Noryungi]

Here is something really funny for you: I also travel with several CDs (music and/or data) in my luggage. I have never been stopped, not just once, by the US customs.

I mean, seriously, what's to prevent me from slipping the Symantec CD-ROM in a little Case Logic CD folder, among dozens of other CDs? Do you really think the customs officer are going to check me? Do you think they are going to review each and every CD in my little folder, looking for the illegal-to-export LC5 CD? (short answer: NO).

What about copying an image of the CD on the hard disk of my laptop? Sure, they check laptops, but only to make sure that this is really a computer and not a disguised bomb.

Of course, if the NSA (hi, guys, and thanks for reading this!) decides I am an international terrorist, I am in trouble the next time I set foot in the USA. But I think right now, they are too busy spying on US citizens to bother with me... ;-)

The even sadder thing is

[williewang]

First, the ban assumes that "terrorists" know anything about computers in the first place which, from where I sit, is an almost laughable idea. If they did, we would have been in massive pain years ago.

Second, anyone who has to crack passwords with any regularity uses rainbow tables and/or john with customized tables. They are just better tools.

Third, and most amazing to me, the ban assumes that potential terrorists are somewhere "over there" when *all* of the 9/11 hijackers had spent considerable time in North America--some had been here for years. Even if the transfer of the program overseas was able to be blocked (which is impossible, of course), WTF do they plan on doing about the hundreds of millions here now?

The earlier US ban on the export of high-level encryption began to seriously hurt and slow down American technology companies, prompting the lift of the ban. I have a feeling that should such legislation continue, similar pressure to ease restrictions will be properly and successfully applied. I'm not too terribly worried.

Re:The even sadder thing is

[Anonymous Coward]

Just so you know LC5 had support for rainbow tables and included a 4GB set (just alphanum i think). But if one were to generate an extended table (comes to about 40GB compressed) it would work just as well.

Re:The even sadder thing is

[williewang]

Fair enough (been a while since I used it). Of course, you could just stick with rainbow crack or use CAIN (with or without rainbow tables) for free... Doesn't really matter though--whatever one is comfortable with. I liked L0pht for doing onesie-twosie checking in the past--and it's probably still good at that--I was just so bewildered with the recent law that a negative tone probably unfairly maligned the good folks at LC5. I hope it didn't come across as a flame toward LC5 to you or anyone else. Cheers!

Whew!

[PhotoGuy]

Thank God! Because everyone knows that terrorists and other bad people have no contacts in Canada or the US.

Once they classify CSS as munitions-grade crypto..

[mmell]

they'll be able to come in the middle of the night and take you away (since your computer is able to be connected to foreign computers via the internet and it's possible you might have the DeCSS code on your machine and you might have dated a person with left-leaning tendencies when you were in high school). Of course, they'll have to rigorously check all the MP3's, JPEG's and MPEG's on your computer, since you might have employed steganography to hide messages. If they don't find the evidence on your computer, well, that just means you've hidden it pretty well, eh? Besides, it's just as well that the government looked there, 'cuz the [RI|MP]AA desserves to know what you have on your computer as well.

Senator McCarthy would be proud!

Shut up, all of you.

[orson_of_fort_worth]

There might be foriegners reading this for pete's sake. Let's meet up on IRC in the USA Room (and canada).

LC5 is slow.

[logik3x]

I don't understand why someone would wan to buy a program like l0pthcrack when there are better alternative for free... http://ophcrack.sourceforge.net/ is free and uses rainbow table... you don't even need to generate the tables.. you can download them.. there is even a linux live cd so no need to install it or to have admin access... anyways l0pthcrack used to be the thing but now it's outdated..

No high school level devs elsewhere, I guess

[komodotoes]

I remember reading a comment by Bruce Schneir that said something along the lines of "the code is the easy part, the algorithms are the hard part - any high school level CS student can implement the algorithm." So my question is: does the U.S. want to ban all descriptions of cryptographic algorithms in exported books too? And, as has been pointed out, there are more than a few smart people living outside North America, so I'm thinking more than a few countries already roll their own crypto.



NeverEndingBillboard.com

Symantec killing LC5 product line

[Anonymous Coward]

Dear LC Customer,

The purpose of this letter is to notify you that Symantec Corporation is discontinuing its L0phtCrack (LC) product line and will no longer provide product code updates, enhancements or fixes to this product line.

Key dates in this process are listed below.

Last Date to Order LC5: February 28, 2006

Last Ship Date: March 3, 2006

Customer Help Until Date: December 16, 2006

Symantec will continue to use reasonable commercial efforts to provide available customer support by email to US and Canada based customers who purchased L0phtCrack (LC), products through the dates indicated above. As a courtesy to LC customers, we offer customer help via email regarding product usability inquiries through December 16, 2006.

An FAQ for Licensed Users of L0phtCrack (LC) Products is also attached to help answer commonly asked questions. If you have additional questions about our notification, please contact us by email at mailto:Americas-LCcustserv@symantec.com.

Thank you for your support.

Sincerely,

Sales Operations

Symantec Corporation

FAQ for Licensed Users of L0phtCrack (LC) Products

Question: What versions of the L0phtCrack (LC) product line are impacted by this Sunset Plan?

Answer: All versions of LC product line are impacted as described in this notification to customers. Symantec will discontinue its sale of the current and previously available versions of the product as well as its provision of product upgrades, updates and fixes for all versions of the product effective per the dates mentioned above.

Question: Why is the LC product line being discontinued?

Answer: The LC product line no longer fits into Symantec's future product strategy. As a result, Symantec will not be applying any future development resources to this product line and will discontinue all sales.

Question: What form of customer support is available to licensed users/customers of LC products?

Answer: LC Customers did not pay for technical product support as part of their LC license agreements, and Symantec does not offer technical support for this product line. Customers based in the US and Canada can inquire about general product use/usability by email to Americas-LCcustserv@symantec.com through December 16, 2006. Customers who re-install their licensed copy of LC and need an Unlock Code can submit an email request to Americas-LCcustserv@symantec.com with the following information through December 16, 2006:

LC version number (2.5, LC3, LC4 or LC5):

If LC5, please indicate if you've purchased the Professional or Administrator edition:

LC Serial Number:

Company Name:

Complete Company Address (street, city, state/prov, zip/postal code):

Company URL:

Nature of Business:

Commercial or Public Sector (if Public Sector, please specify government, military or police):

Contact Name:

Contact Phone Number:

Question: Can LC licensed users continue to use LC products after this Sunset Plan notification has been sent to Customers?

Answer: Professional and Administrator users have perpetual license to use the LC product they purchased. Consultant users have one year license from date of product receipt to use the LC product they purchased.

Question: Where can the customer get more information about LC5 and the FAQ Documentation about the product?

Answer: LC5 product information is available with the software installation of the product under the Help menu. Licensed LC customers may also submit product inquiries to Americas-LCcustserv@symantec.com with the following information through December 16, 2006:

LC version number (2.5, LC3, LC4 or LC5):

If LC5, please indicate if you've purchased the Professional or Administrator edition:

LC Serial Number:

Company Name:

Complete Company Address (street, city, state/p

No prob

[LurkerML]

I for one welcome our new encrypted overlord.

Numbers are wrong

[Anonymous Coward]

(and 1 Socialist?) in Congress

There are 534 socialists in Congress. Only one of them has the intellectual honesty to actually call himself one.

It isn't sold in the US/Canada either

[wfsavenger]

This was already sent out to all LC5 customers. Symantec has planned to kill the product for a long time....
--Avenger

Dear LC Customer,
The purpose of this letter is to notify you that Symantec Corporation is discontinuing its L0phtCrack (LC) product line and will no longer provide product code updates, enhancements or fixes to this product line.
Key dates in this process are listed below.
Last Order Date: February 28, 2006
Last Ship Date: March 3, 2006
Customer Help Until Date: December 16, 2006
Symantec will continue to use reasonable commercial efforts to provide available customer support by email to US and Canada based customers who purchased L0phtCrack (LC) products through the dates indicated above. As a courtesy to LC customers, we offer customer help via email regarding product usability inquiries through December 16, 2006.
An FAQ for Licensed Users of L0phtCrack (LC) Products is also attached to help answer commonly asked questions. If you have additional questions about our notification, please contact us by email at mailto:Americas-LCcustserv@symantec.com.
Thank you for your support.
Sincerely,
Sales Operations Symantec Corporation

free as in `libre' speech == free commerce

[brokeninside]

When the product in question consists of little more than the expression of an idea, it is very hard to make a case that selling that idea is not free speech. First, the Supreme Court of the United States has decreed that spending money is a form of expression and, consequently, falls under the heading of freedom of speech.

But, more importantly, freedom of commerce is one of the lynchpin ideas of liberalism. Hugo Grotius in The Free Sea argued that restriction of trade is essentially an act of war, for freedom of trade is one of the essential human rights:

Nature had given all things to all men, but seeing they were barred from the use of many things whereof man's life standeth in need by reason of the distance of places, it was needful to pass over from place to place. Neither yet was there permutation, but finding other things with others they used them at their pleasure by course. Almost after the same manner they report the Seres do, who, leaving their goods in the wilderness, the bargain is made only by the honesty and conscience of the changers.

Grotius argues that human beings are limited in what they can provide with their own hands and, therefore, trade is necessity for living and, therefore, negotiating with others is a fundamental right. For the government to step in and infringe upon that right, in this view, is a violation of the very nature of humanity. Consequently, it is incumbent upon the government to demonstrate the necessity of prohibiting trade. Short of being at war with another nation, Grotius would argue that there is no good reason.

Stupid

[phorm]

Nobody would be stupid enough to think it is possible to keep a commercial product out of foreign hands

It's a bit of stupidity mixed with deviousness. This isn't about restricting tech to foreign countries so likely as it's the ability to arrest/incarcerate anyone who distributes them. The might not be able to control the flow of such tech outside of the country, but it gives them another reason to arrest anyone who they can nail as a distributor should they need an extra charge or two to lay down.

So how does that affect us Canadians

[phorm]

OK, so this is a US law, but the product is available in Canada. So what about Canadian resells? How about me as a user. I could buy the software, and then resell it to somebody in another country. EULA preventing that... how about if I leave the shrink-wrap on, then I haven't agreed to anything.

Not that such laws would actually have a snowball's chance in hell of preventing this software from reaching other countries, but I do wonder when the US includes Canada in their private little party whether or not they expect us to play with their rulebook.

Official Secrets Act

[Anonymous Coward]

The UK Official Secrets Act covers any material that the government claims is "harmful to national security". There is no public interest defense (there was one, but it was removed in 1989). What's more, it's still a crime even if the information is already in the public domain, and journalists who report such information can also be prosecuted.

In the USA, whistleblowers are protected by law. In the UK, they're thrown in the slammer.

It's Going End Of Life Anyway...

[seigniory]

Got this in the mail yesterday:

--

Subject: Sunset Plan for L0phtCrack (LC) Products

Dear LC Customer,

The purpose of this letter is to notify you that Symantec Corporation is
discontinuing its L0phtCrack (LC) product line and will no longer
provide product code updates, enhancements or fixes to this product
line.

Key dates in this process are listed below.

Last Order Date: February 28, 2006

Last Ship Date: March 3, 2006

Customer Help Until Date: December 16, 2006

Symantec will continue to use reasonable commercial efforts to provide
available customer support by email to US and Canada based customers who
purchased L0phtCrack (LC) products through the dates indicated above.
As a courtesy to LC customers, we offer customer help via email
regarding product usability inquiries through December 16, 2006.

An FAQ for Licensed Users of L0phtCrack (LC) Products is also attached
to help answer commonly asked questions. If you have additional
questions about our notification, please contact us by email at
mailto:Americas-LCcustserv@symantec.com.

Thank you for your support.

Sincerely,

Sales Operations
Symantec Corporation

Maybe it's misclassified?

[rhekman]

Here's the Dept. of Commerce website that describes the classification and licensing of exported goods: http://www.bis.doc.gov/Licensing/ExportingBasics.h tm

Here Here

[Anonymous Coward]

Here Here. While I agree with the principles mentioned. In the post. IE the government should not restrict the transport of technology ideas and science between countries the poster is a little overzealous and short of facts in his argument.

As an example. The transportation of munitions plans as a whole is over the top. If I try to sell a firearm to Iran then odds are I am selling a product to Iran that they are more then capable of designing themselves. Meanwhile I am improving my countries economic strength. If on the other hand I try to sell the designs to a ICBM nuclear missile to Iran. Then odds are I work for a company that has access to secret design plans and have signed a legal document making this action illegal.

We already have laws. Very effective ones to protect this sort of information. If the information I am selling is available to the US general public then distributing it is by its nature a act of speech. IE the passing of information from one person to another. And restricting its passage is only limiting the freedoms of our own people not preventing those who wish to harm us from getting the information.

And for the poster who submitted the 9/11 comment. The restriction of technology would have in no way prevented that attack. They did not use encryption technology or munitions or anything else. So unless you wish to include information of how to fly an aircraft in your list of banned information it is an invalid comment. And in all honesty is just the sort of .. Well we are at war we need to do X argument that the US government is overusing to restrict the rights of its people.

It seems now that any time you disagree with the governments actions you are supporting terrorism. That is not the way a free country should be run.

Secret Word

[Hoi Polloi]

Whatever you do, don't tell anyone in any other countries the word "FOO". It is our secret. We even have a law saying so, so there!

export laws are just a cover

[xeno]

Symantec has been told by the Feds to stop exporting LC5? Oh, the horror. Except it's horseshit. I was part of Symantec's aquisition of @stake, and if the Feds have anything to do with this, it's far and away a secondary reason for the restriction.

The truth of the matter is that Sym's Legal dept is terrified of LC5, and this is a convenient excuse if it's true at all. Just as they were frightened by the liability and publicity implications of @stake's decompilation and automated app security checking tool, and are "spinning it off." God forbid someone runs that tool against one of their own products. (Not that it's happened. :) Similarly, they were so terrified of @stake's WebProxy (imho the best app for web app security assessment/pentest) that they deep-sixed it so far that many product and services sales droids were told to deny its existence.

It's a damn shame. These were great tools. I wonder if it's better to have them die suddenly, than go the Norton route of slow deterioration and bloat...? Criminy, it's only been 14 months since the @stake aquisition, and from what I know since departing there are no products left from @stake and a very small percentage of the @stake staff left. Not a very well-managed investment, if you ask me.

J

Re:export laws are just a cover

[rainer_d]

It's a damn shame

Come on - you cannot tell me that nobody @@stake didn't know that this was bound to happen.
It's not rocket science - just mentally create a "short-list" of successful Symantec-aquisitions, compared to a "short-list" of aquisitions where the product ended as pure and utter crap.
Or how else can you explain the comment "Oh no - that was the only such service that was actually good and usable" someone blurted on a (mailserver-)mailinglist about the recent aquisition of Brightmail by Symantec...

I found that funny at first, but also find it sad, because it's always sad to loose a good product - and I know it's even more sad for the people envolved in creating the original product. So much sweat, blood and tears....swoosh ... all flushed down the toilet.

Re:export laws are just a cover

[drwho]

Yes, Zeno, you've pretty much hit the nail on the head, from what the ex at-stake people tell me. Except that they don't want to spin off the decompiler tech, they want it to die. If you have any knowledge that conflicts with this, please gimmie details, I'd love to know more.

It makes me wonder what Symantec DID buy @Stake for, if they're getting rid of the talented people and canning the products. The paranoid part of me says that they were put up to this task by some 'sinister force' that wants @stake gone. But I don't really believe that, do I?

Re:export laws are just a cover

[Anonymous Coward]

I left a few months ago and you are correct in your assumptions. All products have been 86'd and none of the product staff are there anymore. A majority of the west coast consulting staff are gone and the rest of the offices have had slow trickles of turn over. WebProxy is/was the best web app tool I've ever used and sadly the creator of the tool is still there. I imagine that it is still used internally by the consulting staff but it will never see the light of day again. I don't know that the spin off of the decompilation software is going to happen. This is just my own gut feeling but I don't think Symantec will allow it to happen. Like you said, they are terrified of it. What better way to deal with it then to throw the code away and retain the rights to it so no one can rewrite it again?
As for the investment I think you may be wrong. What remains is a set of consultants with the @stake brand who can now "recommend" Symantec products to cure any ailments found after an assessment. They don't have to be agnostic anymore. And don't forget that most of the @stake sales staff were told to take a hike as well. The new sales force will do a lot of cross selling after an assessment too.

zero

Resetting the password loses the crypto keys

[steve_l]

XP encrypts the crypto keys with the current password value, so if you reset the password, you still dont have access to encrypted bits of the HDD. Unless, of course, the system you have acquired is a laptop/PC in hibernate mode, in which case they will probably be stored in the clear somewhere (I guess :)

In other news...

[mnmn]

...The playstation 3 is banned from export from the US entirely. Sadly, Japan is where its made anyway so its everywhere.

Hmm. I'm a terrorist from Al Qaeda on a computer somewhere in Pakistan/Afghanistan/MiddleEast with an Internet connection. I need strong cyphers.

So hmm lemme see. What do I do? Either:

(1) I cry and whine that the US wont let me BUY a copy of symantec, in a country where 99% of the software is pirated. OR

(2) I google it up and download any tool I need. OR

(3) I goto the local software store and go 'Yo Osama can I have a symantec US edition, and a dvd or oracle, one of websphere and another of windows 2003 datacenter edition as well?'. He goes 'Sure thats (eq 10 cents)'. I go home and build Weapons of Mass Destruction (tm).

I HATE multiple choice.

Re:Violation of my rights (not hardly)

[jdcope]

A violation of "freedom of speech" would be the feds telling Symantec that they cant create the software in the first place. Restricting where they sell it is not. The first Amendment only guarantees freedom to create speech/expression, not an audience for said expression. By your theory, do you think that porn not being sold to minors is a violation of the publisher's free speech "rights"?

The patent system helped too

[Cardbox]

The patent system helped too. When we developed the world's first commercially available RSA chip the RSA patent didn't apply outside the USA (because the principle had been published in academic papers before the patent was granted) and RSA hardware couldn't be exported to compete with ours (because of USA export restrictions).

Symantec: You Stink

[nighty5]

I remember the days when @Stake sold L0phtcrack for a large chunk of change.

Symantec decided to change it to a less hax0r name, and remove "crack" from all references and replace it with "audit".

Now they want to stop the selling of a product thats almost used exclusively by security professionals around the world to ensure compliance against password mis-use.

Its ironic that Symantec have done exactly they what they said they wouldnt do, screw with the product too much. You just have to visit http://www.atstake.com/ and read their mission statement to the product:

          @stake Acquired by Symantec

Welcome to Symantec. Symantec recently acquired @stake. We recognize that the strength of an organization is built on the loyalty of its customers, and we are committed to providing a seamless transition for @stake's customers.

Existing customers should expect business as usual through the transition period and a continuation of the same great service you have come to expect from @stake.

Great...

[JRHelgeson]

So, let me get this straight, you can no longer legally purchase the software overseas, it is only available bundled with the keygen on Torrentspy?

So the only way to get it now overseas is for FREE?!

WOO HOO!!!

Here: I'll save you the torrentspy search:
http://ts.searching.com/download.asp?id=366179

The horses are already out of the barn, you morons!

Does it run under Linux?

[Anonymous Coward]

5:20pm (GMT)-Downloads the torrent file from "http://www.seedler.org/en/iindex.x?a=info&id=1952 55" 5:21pm (GMT)-Launches Azureus and starts torrent download. 5:26pm (GMT)-Azureus completes download.Also seeing. 5:26pm (GMT)-Runs lc5 Setup 5:27pm (GMT)-lc5 setup complete,runs lc5,runs keygen and unloacks lc5

And to pose the obligitory question: "Does it run on Linux?" the answer is Yes.

The install, the keygen and the program all work perfectly in Linux under wine, and probably with less threat of trojan infestation than installing an unknown h4xx0r torrent on XP or 2K3 ;)

Well, this makes perfect sense to me

[ScrewMaster]

because as everyone knows, once the United States Congress passes a law regarding what can and cannot be done on the Internet, everyone the whole world over immediately obeys. Equally, of course, data cannot be sent to a foreign country via the Internet once it has been deemed contraband. I wish our government would just get a grip, and realize that anyone that wants this stuff will get it, with ease, legally or illegally, and it doesn't matter where they are. Yes, the intent may be to hinder anyone that wishes to act against the United States and its citizens, but the only real effect (as always in these cases) is to harm American business. Symantec loses some customers and revenue, and those foreign nationals that want the software grab it from some warez site (or have someone here buy it and send it to them.)

The other, rather arrogant aspect to this is the presumption that only American vendors can write good encryption software. There are plenty of good programmers overseas, and if companies and individuals can't buy what they need from an American vendor, they'll just buy it from a local company. More U.S. businesses lose customers.

I guess I just don't see the point anymore. Maybe twenty years ago ... but not today.

mods on crack

[DrYak]

yes, but sadly you got moded "Insightful". ...in days like this I think I could loose hope in humanity.

That, or the mods doing some very sophisticated kinds of sarcasm. (see sig.)

Yeah, ok, whatever.

[synthespian]

Who cares? We've seen this eons ago with PGP (Pretty Good Privacy).
Too bad for American business, huh?
I guess it's just a swell opportunity for Canadians. ;-)